CondorCORE/condorcore-keyring
CondorCORE/condorcore-keyring
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

update-keys: use array for $GPG

Browse Source 
Embedding quotes in a string doesn't work, it just causes KEYSERVER to
not be quoted at all.

Signed-off-by: Christian Hesse <mail@eworm.de>
This commit is contained in:
Eli Schwartz 2019-08-05 17:05:17 -04:00 committed by Christian Hesse
parent c4f33de41d
commit 0d99720ded
1 changed files with 17 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
update-keys
View File

@ -8,11 +8,11 @@ TMPDIR=$(mktemp -d)
trap "rm -rf '${TMPDIR}'" EXIT trap "rm -rf '${TMPDIR}'" EXIT
KEYSERVER='hkp://pool.sks-keyservers.net' KEYSERVER='hkp://pool.sks-keyservers.net'
GPG="gpg --quiet --batch --no-tty --no-permission-warning --export-options no-export-attributes --keyserver "${KEYSERVER}" --homedir ${TMPDIR}" GPG=(gpg --quiet --batch --no-tty --no-permission-warning --export-options no-export-attributes --keyserver "${KEYSERVER}" --homedir "${TMPDIR}")
pushd "$(dirname "$0")" >/dev/null pushd "$(dirname "$0")" >/dev/null
$GPG --gen-key <<EOF "${GPG[@]}" --gen-key <<EOF
%echo Generating Arch Linux keyring temporary master key... %echo Generating Arch Linux keyring temporary master key...
Key-Type: RSA Key-Type: RSA
Key-Length: 2048 Key-Length: 2048
@ -25,7 +25,7 @@ Expire-Date: 0
%echo Done %echo Done
EOF EOF
${GPG} --import < archlinux.gpg "${GPG[@]}" --import < archlinux.gpg
rm -rf master{,-revoked} packager{,-revoked} archlinux-{trusted,revoked} rm -rf master{,-revoked} packager{,-revoked} archlinux-{trusted,revoked}
mkdir master packager master-revoked packager-revoked mkdir master packager master-revoked packager-revoked
@ -34,10 +34,10 @@ mkdir master packager master-revoked packager-revoked
while read -ra data; do while read -ra data; do
keyid="${data[0]}" keyid="${data[0]}"
username="${data[@]:1}" username="${data[@]:1}"
if ${GPG} --list-keys ${keyid} >/dev/null &>/dev/null; then if "${GPG[@]}" --list-keys ${keyid} >/dev/null &>/dev/null; then
${GPG} --refresh-keys ${keyid} &>/dev/null "${GPG[@]}" --refresh-keys ${keyid} &>/dev/null
else else
${GPG} --recv-keys ${keyid} &>/dev/null "${GPG[@]}" --recv-keys ${keyid} &>/dev/null
fi fi
done < <(cat master-keyids master-revoked-keyids packager-keyids packager-revoked-keyids) done < <(cat master-keyids master-revoked-keyids packager-keyids packager-revoked-keyids)
@ -45,19 +45,19 @@ done < <(cat master-keyids master-revoked-keyids packager-keyids packager-revoke
while read -ra data; do while read -ra data; do
keyid="${data[0]}" keyid="${data[0]}"
username="${data[@]:1}" username="${data[@]:1}"
printf 'minimize\nquit\ny\n' | ${GPG} --command-fd 0 --edit-key ${keyid} printf 'minimize\nquit\ny\n' | "${GPG[@]}" --command-fd 0 --edit-key ${keyid}
${GPG} --yes --lsign-key ${keyid} &>/dev/null "${GPG[@]}" --yes --lsign-key ${keyid} &>/dev/null
${GPG} --armor --no-emit-version --export ${keyid} >> master/${username}.asc "${GPG[@]}" --armor --no-emit-version --export ${keyid} >> master/${username}.asc
echo "${keyid}:4:" >> archlinux-trusted echo "${keyid}:4:" >> archlinux-trusted
done < master-keyids done < master-keyids
${GPG} --import-ownertrust < archlinux-trusted 2>/dev/null "${GPG[@]}" --import-ownertrust < archlinux-trusted 2>/dev/null
# master-revoked-keyids # master-revoked-keyids
while read -ra data; do while read -ra data; do
keyid="${data[0]}" keyid="${data[0]}"
username="${data[1]}" username="${data[1]}"
printf 'clean\nquit\ny\n' | ${GPG} --command-fd 0 --edit-key ${keyid} printf 'clean\nquit\ny\n' | "${GPG[@]}" --command-fd 0 --edit-key ${keyid}
${GPG} --armor --no-emit-version --export-options export-minimal --export ${keyid} >> master-revoked/${username}.asc "${GPG[@]}" --armor --no-emit-version --export-options export-minimal --export ${keyid} >> master-revoked/${username}.asc
echo "${keyid}" >> archlinux-revoked echo "${keyid}" >> archlinux-revoked
done < master-revoked-keyids done < master-revoked-keyids
@ -65,11 +65,11 @@ done < master-revoked-keyids
while read -ra data; do while read -ra data; do
keyid="${data[0]}" keyid="${data[0]}"
username="${data[@]:1}" username="${data[@]:1}"
printf 'clean\nquit\ny\n' | ${GPG} --command-fd 0 --edit-key ${keyid} printf 'clean\nquit\ny\n' | "${GPG[@]}" --command-fd 0 --edit-key ${keyid}
if ! ${GPG} --list-keys --with-colons ${keyid} 2>/dev/null | grep -q '^pub:f:'; then if ! "${GPG[@]}" --list-keys --with-colons ${keyid} 2>/dev/null | grep -q '^pub:f:'; then
echo "key is not fully trusted: ${keyid} ${username}" echo "key is not fully trusted: ${keyid} ${username}"
else else
${GPG} --armor --no-emit-version --export ${keyid} >> packager/${username}.asc "${GPG[@]}" --armor --no-emit-version --export ${keyid} >> packager/${username}.asc
fi fi
done < packager-keyids done < packager-keyids
@ -77,8 +77,8 @@ done < packager-keyids
while read -ra data; do while read -ra data; do
keyid="${data[0]}" keyid="${data[0]}"
username="${data[1]}" username="${data[1]}"
printf 'clean\nquit\ny\n' | ${GPG} --command-fd 0 --edit-key ${keyid} printf 'clean\nquit\ny\n' | "${GPG[@]}" --command-fd 0 --edit-key ${keyid}
${GPG} --armor --no-emit-version --export-options export-minimal --export ${keyid} >> packager-revoked/${username}.asc "${GPG[@]}" --armor --no-emit-version --export-options export-minimal --export ${keyid} >> packager-revoked/${username}.asc
echo "${keyid}" >> archlinux-revoked echo "${keyid}" >> archlinux-revoked
done < packager-revoked-keyids done < packager-revoked-keyids